| Package | Affected versions | Patched versions |
|---|---|---|
| snipe/snipe-it | < 8.6.0 | 8.6.0 |
| snipe-it | < 8.6.0 | 8.6.0 |
The store() method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges.
The users.create permission may commonly be delegated to HR staff, department leads, or similar roles.
Patched in aea3877718
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free